fix: Fixes to platform page

sitesvc/internal/api/signup.go

@@ -159,8 +159,8 @@ func (s *Server) handleVerify(w http.ResponseWriter, r *http.Request) {
 
 	log.Printf("verify: provisioned org %s (%s)", org.Slug, org.OrgID)
 
-	if s.appLoginURL != "" {
-		http.Redirect(w, r, s.appLoginURL, http.StatusSeeOther)
+	if login := s.loginURL(org.Slug); login != "" {
+		http.Redirect(w, r, login, http.StatusSeeOther)
 		return
 	}
 
@@ -168,6 +168,21 @@ func (s *Server) handleVerify(w http.ResponseWriter, r *http.Request) {
 		fmt.Sprintf("%s is set up and you are its owner. You can sign in now.", org.Name))
 }
 
+// loginURL is the org-specific sign-in URL a verified owner is sent to. Each
+// org lives on its own subdomain (<slug>.vantage.hostxtra.co.uk), so the slug
+// must be substituted per signup rather than pointing at one shared address.
+//
+// APP_LOGIN_URL is a template. A "{slug}" placeholder is replaced with the
+// org's slug; a value without one is treated as a literal (a single shared
+// login page) so a plain URL still works. An empty value falls back to the
+// confirmation page.
+func (s *Server) loginURL(slug string) string {
+	if s.appLoginURL == "" {
+		return ""
+	}
+	return strings.ReplaceAll(s.appLoginURL, "{slug}", url.PathEscape(slug))
+}
+
 func (s *Server) verifyPage(w http.ResponseWriter, status int, heading, detail string) {
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	w.Header().Set("X-Content-Type-Options", "nosniff")